Re: [PATCH] fou: reject FOU_ENCAP_DIRECT with protocol 0 to prevent sk_buff leak

[Hangbin Liu]

On Sat, Sep 19, 2026 at 09:52:38PM +0000, Hui Peng wrote:
> In fou_udp_recv(), returning -fou->protocol to udp_queue_rcv_one_skb()
> triggers IP protocol resubmission when fou->protocol > 0, whereas returning
> 0 tells the UDP tunnel layer that the skb was consumed without freeing it.
> When a FOU_ENCAP_DIRECT socket is configured with FOU_ATTR_IPPROTO == 0,
> every received packet returns 0 from fou_udp_recv() and leaks the sk_buff.
> 
> Reject FOU_ENCAP_DIRECT configurations with protocol 0 in parse_nl_config()
> and drop packets if !fou->protocol in fou_udp_recv().
> 
> Fixes: 08d323234d10 ("net: fou: rename the source for linking")
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@xxxxxxxxx>
> ---
> diff --git a/net/ipv4/fou_core.c b/net/ipv4/fou_core.c
> index 5e867f1b5c1d..3fc087c808bc 100644
> --- a/net/ipv4/fou_core.c
> +++ b/net/ipv4/fou_core.c
> @@ -77,6 +77,9 @@ static int fou_udp_recv(struct sock *sk, struct sk_buff *skb)
>  	if (!fou)
>  		return 1;
>  
> +	if (unlikely(!fou->protocol))
> +		goto drop;
> +
>  	if (fou_recv_pull(skb, fou, sizeof(struct udphdr)))
>  		goto drop;
>  
> @@ -696,6 +699,9 @@ static int parse_nl_config(struct genl_info *info,
>  	if (info->attrs[FOU_ATTR_TYPE])
>  		cfg->type = nla_get_u8(info->attrs[FOU_ATTR_TYPE]);
>  
> +	if (cfg->type == FOU_ENCAP_DIRECT && !cfg->protocol)
> +		return -EINVAL;
> +
>  	if (info->attrs[FOU_ATTR_REMCSUM_NOPARTIAL])
>  		cfg->flags |= FOU_F_REMCSUM_NOPARTIAL;
>  

The patch looks good to me. But the fixes tag is incorrect. Looks the LLM
only find the tag based on the file name.

Thanks
Hangbin